dsh-openai-codex

dsh-openai-codex is an experimental, out-of-tree DeepSeek Harness plugin. It registers pi-ai's openai-codex models against the public DSH ctx.llm adapter seam and manages a ChatGPT OAuth login in its own credential file. It does not patch or replace an installed DSH package.

The plugin targets @deepseek-ai/dsh 0.1.0-rc.7. ChatGPT sign-in is subscription-backed access, not OpenAI Platform API billing. This third-party integration uses the Codex backend behavior implemented by pi-ai; OpenAI documents ChatGPT sign-in for official Codex clients, not this plugin, so endpoint or policy changes may break it.

Install

Install the tagged GitHub release into each DSH profile that should expose Codex:

dsh plugin --profile headless add github:bufeibufei/dsh-openai-codex#v0.1.1
dsh plugin --profile web add github:bufeibufei/dsh-openai-codex#v0.1.1

The repository ships runnable JavaScript and reuses DSH rc.7's installed pi-ai runtime through an exact peer dependency, so a GitHub installation requires no package build.

The release also publishes a tarball for an offline or pinned local installation:

dsh plugin --profile web add .\dsh-openai-codex-0.1.1.tgz

Authenticate

Run the plugin's binary inside either installed profile. Both profiles share the same credential when they use the same DSH_HOME:

dsh plugin --profile headless exec dsh-codex-auth login

Open the displayed URL, enter the device code, and approve access. Device-code login may need to be enabled in your ChatGPT security or workspace settings.

Node does not enable environment-proxy support by default. When the terminal uses HTTP_PROXY or HTTPS_PROXY, enable it for login, refresh, and model requests before starting DSH:

$env:NODE_USE_ENV_PROXY = '1'

Other commands:

dsh plugin --profile headless exec dsh-codex-auth status
dsh plugin --profile headless exec dsh-codex-auth models
dsh plugin --profile headless exec dsh-codex-auth path
dsh plugin --profile headless exec dsh-codex-auth logout

After login, open DSH's Models settings and choose provider openai-codex plus one of the listed models. For a CLI-only profile, set the same provider/model through the existing DSH settings surface before starting a task.

Verify the bundle layer without starting an agent:

dsh --profile headless --dump-config

Storage and security

The credential is stored at $DSH_HOME/.dsh-openai-codex/auth.json, or ~/.dsh/.dsh-openai-codex/auth.json when DSH_HOME is unset. Writes use a same-directory temporary file, atomic rename, and a cross-process writer lock. POSIX installations request directory mode 0700 and file mode 0600.

These permissions protect against other OS users only. DSH tools that run as your own user may be able to read this file and put tokens into a session transcript. Use an isolated OS account or filesystem policy for untrusted agents. Never commit the file, attach it to diagnostics, or paste its contents.

The managed OAuth token is sent only through pi-ai's fixed https://chatgpt.com/backend-api Codex provider. The plugin exposes no endpoint override or custom-header setting. It fixes transport to SSE so a completed one-shot DSH process does not retain an authenticated WebSocket cache.

Compatibility limits

• This package deliberately has no native dsh auth top-level command and no OAuth card in the DSH Web UI; those require host product surfaces. Its command is dsh-codex-auth, invoked through dsh plugin ... exec.
• Do not also configure an openai-codex route in DSH's built-in llm-pi-ai settings. Two adapters cannot own the same route.
• The implementation is pinned to pi-ai 0.82.1, matching DSH 0.1.0-rc.7's adapter event format.
• The plugin does not reuse or overwrite codex login state in ~/.codex/auth.json.

Development

npm install
npm run check
npm test
npm pack

All tests are keyless. A real login and model call require an eligible ChatGPT account.